Chatterbug Formsに認証不要のファイルアップロード脆弱性
Summary
WordPressのフォーム用プラグインChatterbug Formsの1.0.2以前に、ログイン不要でPHPなどのファイルを置かれ、サーバー上でコードを実行されるおそれのある脆弱性が公表されました。使っているサイトは版を確認し、修正版がなければ無効化を検討してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressのフォーム用プラグインChatterbug Formsの1.0.2以前に、ログイン不要でPHPなどのファイルを置かれ、サーバー上でコードを実行されるおそれのある脆弱性が公表されました。使っているサイトは版を確認し、修正版がなければ無効化を検討してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| sameh101Chatterbug Forms – Fast, Flexible WordPress Form Builder |
≤ 1.0.2→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.
Source: CVE.org (CVE Program・cvelistV5) NVD